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Argument 

A. Claims 1-6, 8-11, 14, 15, 17-20, and 23-26 are patentable over Mattsson in view of 
Ludwig, Low, and Vaitzblit 

Independent claim 1 recites an apparatus that monitors a user's actual accesses to a 
database until a preselected quantity of actual accesses have been observed, and adjusts the 
user's authorized access by denying the user's future access to authorized database tables and 
authorized columns that are not included in a set of accessed database tables and accessed 
columns. 

In the Examiner's Answer, the Examiner relied on Ludwig to teach denying "the user 
future database access to an authorized database table or an authorized column that is not in the 
set of accessed database tables and accessed columns". Specifically, the Examiner asserted that 
because Ludwig teaches disabling inactive accounts that may be used to handle database 
administration, Ludwig teaches adjusting a user's authorization to deny future access to 
authorized table/columns that were previously authorized, but not accessed. Even though 
expiring an inactive account prohibits subsequent database accesses using the account, such 
prohibition is contingent upon lack of account activities including database accesses. As argued 
in the Appeal Brief, if there is no database access, then no database table or column is actually 
accessed and there would be nothing for the analysis module to compare. Under such an 
interpretation Mattsson would not deny any database access since it uses item access rate to 
detect intrusion, and lack of database activity means the item access rate cannot be reached. In 
addition, because no database access can be made using an expired account, Ludwig cannot 
teach the above-cited denying limitation since such database access is impossible to begin with. 
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In the Examiner's Answer, in challenging the Appellants' argument that the combination 
of Mattsson and Ludwig would not work, the Examiner asserted that there is no claim language 
that ties the command monitoring module and the analysis module, and that the analysis module 
is not required to compare the actual accesses observed by the command monitoring module. 
Appellants respectively submit that claim 1 explicitly recites "a command monitoring module 
configured to monitor the user's actual accesses . . . including a set of accessed database tables 
and accessed columns" and "an analysis module configured to . . . deny the user future database 
access to an authorized database table or an authorized column that is not in the set of accessed 
database tables and accessed columns". (Emphasis added.) Therefore, the analysis module 
adjusts the user's authorized access based on the actual accesses monitored by the command 
monitoring module. Accordingly, the Examiner's assertion is erroneous and Appellants' 
argument challenging the validitity of the combination of Mattsson and Ludwig is valid. 

Accordingly, Appellants respectfully submit that a person of ordinary skill in the art 
would not find the invention of independent claim 1 obvious in view of the cited references. The 
rejection of independent claims 5 and 14, and of the dependent claims is improper for at least the 
same reason. 

B. Claim 25 is patentable over Mattsson in view of Ludwig 

Dependent claim 25 depends from claim 5 and recites the following additional claim 
limitation: "generating a map of which tables and columns of the database were accessed during 
the observing." 

In the Examiner's Answer, the Examiner asserted that (1) the observing step, comparing 
step, and adjusting step of claim 5 are not required to happen in any particular order, and (2) the 
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map generating step in claim 25 relates to the tables/columns accessed during the observing step 
and not the table/column access compared to the user's authorized access during the comparing 
step. 

Appellants respectfully submit that claim 5 explicitly recites "observing the user's actual 
accesses . . . including a set of accessed database tables and accessed columns" and "adjusting the 
user's authorized database access taking into account results of the comparing step ... to deny 
the user future database access to an authorized database table or an authorized column that is 
not in the set of accessed database tables and accessed columns." Therefore, the adjusting step 
uses results of the comparing step to deny future database access not in the set of accessed 
database tables/columns included in the user's actual accesses observed in the observing step. 
Therefore, the comparing step at least implicitly recites comparing the user's actual accesses 
observed in the observing step with the user's authorized access. Accordingly, claim 5 requires 
that the observing step, comparing step, and adjusting step happen in this order. Also, the map 
generating step in claim 25 relates to not only the tables/columns accessed in the observing step 
but also the table/column access compared to the user's authorized access in the comparing step. 

As argued in the Appeal Brief, because the additional claim limitation of claim 25 at least 
implicitly recites that some tables and columns were actually accessed during observation, which 
means that Ludwig cannot be combined with Mattsson in the manner shown in the Office Action 
in rejecting independent claim 5. Therefore, Mattsson and Ludwig, whether considered 
individually or in combination, fail to disclose each and every limitation recited in claim 5 and 
incorporated by reference in claim 25. 
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Accordingly, Appellants submit that a person of ordinary skill in the art would not have 
found the additional elements of dependent claim 25 obvious in view of the cited references at 
the time the invention was made. 

Summary 

For the foregoing reasons, Appellant believes that the Examiner's rejections of claims 1- 
6, 8-11, 14, 15, 17-20, and 23-26 were erroneous, and respectfully request that the Board reverse 
the rejections. 

Respectfully submitted, 
HARLAN SEYMOUR ET AL. 
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